Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

Using someone else's IP, such as claiming that something you're distributing is an episode of their show, most certainly qualifies for a valid DMCA takedown notice.

My fave was spending a weekend downloading the good omens radio series to find it was Queen's Greatest Hits

Aren’t we still vulnerable through VMs, though? I seem to remember reading something about why Qubes OS is safer than a regular VM, having to do w/ zero trust, etc.

there was a tendency for MUCH worse surprises to be included.

Yeah, like strange unreleased Weird Al tracks with sex and drugs references... Every spoof was labeled weird Al back in 2000

Unhiding extensions wouldn't help here, as the .lnk extension is hidden even if you unhide the others, as it's the extension for shortcut files; you have to edit an obscure registry key if you want to unhide it.

(That said, it being a shortcut it should have the small shortcut arrow in the icon, unless you've used a third party tool or the registry to disable it, so it should still be easily recognisable as a shortcut.)

Operating a computer used to be a specialized skill, you used to have to look under the hood pretty often to make things work. Now all that prep work is taken care of for you, so end users are further away from the partial techs we all used to be.

Dropping into a DOS command line to install software was a normal thing in Windows 95, now if you pull up a command line people think you're a Microsoft Certified Technowizard™.

It depends on the attack vector. Typically you're right, but malicious .lnk files are often paired with other malicious methods to infect machines. Sometimes they're configured as a worm that copies and spreads when a flash drive is connected, sometimes they're configured to download a remote payload when another script or program is started. The problem is that it's a type of file that's often overlooked because it seems innocent.

It isn't necessarily the case that the Trojan needs to be interacted with by the user in order to execute the malicious code. Just having the file on your machine opens the door for all kinds of attacks (especially if you're using a headless setup: you wouldn't necessarily know you have the .lnk file in the system unless you're manually unpacking your downloads yourself). All it needs is for another piece of infected code to run and look for that file, and it can open the door for more traditional malicious code.

Edit: just as a for-instance - If I was a black hat and wanted to spread some malicious code, I could include this .lnk file in a torrent (innocuous enough to slip by unnoticed by most people/unscrupulous pirates), and then maybe place a line of code in a jellyfin plugin or script that looks for that file and executes it if it's found. Because the attack isn't buried in the plugin or script itself (most people wouldn't think much of a line of code that's simply pointing to temp file already on your system), it could theoretically go unnoticed for long enough to catch a few hundred or thousand machines.